Spring Boot项目Git推送时如何加密保护密钥？

Hey there! I’ve dealt with this exact scenario countless times when building Spring Boot apps—keeping secrets out of Git is critical for security. Here are the most practical, widely-used approaches you can implement right away:

This is the simplest starting point, no extra tools needed:

• Local-only config files: Create an application-local.properties (or .yml) file and dump all your secrets (DB passwords, API keys, etc.) here. Then add this file to your .gitignore so it never gets committed. Set your active profile to local for development (add spring.profiles.active=local to your base application.properties).
• Environment Variables: Replace hardcoded secrets with placeholders like ${DB_PASSWORD} in your config files, then set these values as environment variables on your machine. For example, on Linux/macOS: export DB_PASSWORD=your_secure_pass, or on Windows use set DB_PASSWORD=your_secure_pass.
• Command-line arguments: Pass secrets directly when starting your app: java -jar your-app.jar --DB_PASSWORD=your_secure_pass

If you’re working in a team and need to share configs safely, Spring Cloud Config is a great fit:

• Set up a Spring Cloud Config server that pulls config files from a Git repo.
• Encrypt sensitive values using JCE (Java Cryptography Extension) keys. You’ll store encrypted values in the config repo like db.password={cipher}abc123... instead of plain text.
• The encryption key is never stored in Git—you pass it to the config server via environment variables or a secure vault, so only the server can decrypt the values for your app.

For production or sensitive applications, use a dedicated secret manager:

• HashiCorp Vault: Use the spring-cloud-starter-vault-config starter to connect your Spring Boot app to Vault. Configure your app to pull secrets directly from Vault at startup—no sensitive data lives in your code or config files.
• Cloud Provider Secrets Managers: If you’re on AWS, Azure, or GCP, use their built-in tools (AWS Secrets Manager, Azure Key Vault, etc.). Spring Boot has starters or libraries to integrate with these seamlessly, pulling secrets on demand.

Even with the above, it’s easy to slip up—add these safeguards:

• Lock down .gitignore: Always add files containing secrets (.env, application-local.properties, secrets.yml) to .gitignore before writing any secrets. Double-check with git status to make sure they’re marked as untracked.
• Git Secret: A lightweight tool that encrypts specific files before committing. You define which files to encrypt and which team members can decrypt them using GPG keys. It automatically encrypts when you commit and decrypts when you pull, so your Git repo only holds encrypted data.
• Clean up accidental commits: If you already pushed secrets to Git, use the BFG Repo-Cleaner to permanently remove them from your Git history. After cleaning, force push the changes and tell your team to re-clone the repo—old commits with secrets will be gone.

Pro tip: Never rely on "removing" secrets from a file after committing them. Git history is persistent, so even if you delete the secret later, it’s still in the repo’s history.

内容的提问来源于stack exchange，提问作者HARISH